Mailing List Archive: Re: [Ethereal-users] ARP decoding problems

Re: [Ethereal-users] ARP decoding problems

Oct 11, 2000, 7:46 AM

Post #1 of 3 (2086 views)

Ethereal is decoding the data correctly. There really are 6 00's in the
data. On what OS did you
capture this packet?

--gilbert

Shawn Starr <spstarr@visualnet.rootpass.net> on 10/10/2000 06:39:19 PM

To: Gilbert Ramirez/Tivoli Systems@Tivoli Systems
cc:
Subject: Re: [Ethereal-users] ARP decoding problems

Yes here's one packet.

I dont know if its the capturing or decoding but a network engineer of
mine said thats not right.

On Tue, 10 Oct 2000 Gilbert_Ramirez@tivoli.com wrote:

> Can you provide a sample trace file?
>
> --gilbert
>
> Shawn Starr <spstarr@visualnet.rootpass.net> on 10/10/2000 07:13:32 AM
>
> To: ethereal-users@ethereal.com
> cc: (bcc: Gilbert Ramirez/Tivoli Systems)
> Subject: [Ethereal-users] ARP decoding problems
>
>
>
>
> libpcap: 0.4
> libz: 1.1.3
> UCD SNMP 4.1.2
> Ethereal: 0.8.12
>
> Line: 0020: on the decoding of arps shows incorrect information
> Target hardware address: 00:00:00:00:00
>
> is always 12 0's?
>
> Isn't this supposed to be the destination of the MAC address of machine
> its trying to reach?
>
> im confused on this
>
> I have attach 2 PNG images comparing this with another scanner and they
> look very different on the decoding.
>
> Shawn.
>
>

Re: Re: [Ethereal-users] ARP decoding problems [ In reply to ]

gharris at flashcom

Oct 11, 2000, 9:40 AM

Post #2 of 3 (1995 views)

Permalink

> I dont know if its the capturing or decoding but a network engineer of
> mine said thats not right.

If the network engineer in question says it's "not right" because the
target MAC address in an ARP request is all zeroes, said network
engineer should perhaps get a refresher course in networking; as per my
mail, given that the purpose of an ARP request is to *discover* the MAC
address of the machine whose IP (or other) address is in the target
protocol address field, there is no good reason to expect that the
machine's MAC address will be in the request.

RE: Re: [Ethereal-users] ARP decoding problems [ In reply to ]

Fred.Reimer at Eclipsys

Oct 11, 2000, 10:08 AM

Post #3 of 3 (1995 views)

Permalink

I agree. Unless this was an ARP REPLY, the sending station can't know what
the MAC address is by some metaphysical or magical process. That's the
whole PURPOSE behind ARP. It would make me question the knowledge and
experience of this "network engineer." This is classic. I'll have to save
this for my archives.

Fred Reimer - a "network engineer"
Eclipsys Corporation

> -----Original Message-----
> From: ethereal-dev-admin@ethereal.com
> [mailto:ethereal-dev-admin@ethereal.com]On Behalf Of Guy Harris
> Sent: Wednesday, October 11, 2000 12:40 PM
> To: Gilbert_Ramirez@tivoli.com
> Cc: Shawn Starr; ethereal-dev@ethereal.com
> Subject: Re: [Ethereal-dev] Re: [Ethereal-users] ARP decoding problems
>
>
> > I dont know if its the capturing or decoding but a network
> engineer of
> > mine said thats not right.
>
> If the network engineer in question says it's "not right" because the
> target MAC address in an ARP request is all zeroes, said network
> engineer should perhaps get a refresher course in networking;
> as per my
> mail, given that the purpose of an ARP request is to
> *discover* the MAC
> address of the machine whose IP (or other) address is in the target
> protocol address field, there is no good reason to expect that the
> machine's MAC address will be in the request.
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@ethereal.com
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>

Mailing List Archive

Mailing List Archive

Attached Files: